apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  creationTimestamp: "2026-07-24T12:26:01Z"
  generation: 3
  labels:
    kuadrant.io/managed: "true"
  managedFields:
  - apiVersion: extensions.istio.io/v1alpha1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          .: {}
          f:kuadrant.io/managed: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"9431cb09-d9ff-4346-a689-008b0a2368b4"}: {}
      f:spec:
        .: {}
        f:phase: {}
        f:pluginConfig:
          .: {}
          f:actionSets: {}
          f:services:
            .: {}
            f:auth-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
            f:ratelimit-check-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
            f:ratelimit-report-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
            f:ratelimit-service:
              .: {}
              f:endpoint: {}
              f:failureMode: {}
              f:timeout: {}
              f:type: {}
        f:targetRefs: {}
        f:url: {}
    manager: manager
    operation: Update
    time: "2026-07-24T12:26:45Z"
  name: kuadrant-maas-default-gateway
  namespace: openshift-ingress
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Gateway
    name: maas-default-gateway
    uid: 9431cb09-d9ff-4346-a689-008b0a2368b4
  resourceVersion: "22180"
  uid: f03c5443-69da-4513-8373-26f1dea2de61
spec:
  phase: STATS
  pluginConfig:
    actionSets:
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 601d81fda832decfce1c5053e422906c83b94dd9aa69f4b03ab357b22e61bc24
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/chat/completions/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 3f50162934b8442aa1c7d3fe0566b1a268651b5cfb43ca14790d4f6ae94e75b9
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/chat/completions'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 85c982c88d9466ebd7ce94310e7978a85a1c8a6c0f7fcdf68c762b8a79a7860e
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/completions/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: a4672318dbe7de689ca987abd21f718491b5597266f1da5894f0e59c64eab549
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/completions'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: ad7d667caddb2207467d27d0779f1dbeb8f53b0ca39f480c1369b90b0a367604
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/responses/'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 0105d4208d66ad741b8681e85b96793a715e24d0d0a0d2b3204ee65b7d288402
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path == '/v1/responses'
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 83911473fcf646d3aeb0ebfe2232465df1d92f3dfe24d732efb482fe88d2150c
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/chat/completions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: d650c1afdfdf169b5610ad9111b60930f37156b615b0355f0d3daf7d6b652469
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/completions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 98b96558d098c10ea5cd4b877712861a71c554909b27785cf9b672cf28954a5a
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: b47ff88d8f715ce1c182878ed3f0b7215857e31c4ed7fa2045e4147acae6e7ed
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated/v1/responses')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: f9a2a1e13eaadb4f450e63a68a3d05ec02a537019380f832f5992d1c5cdee533
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 51a401bb4ddbb0fe2513a6e765bdfbf6464c5e758b10663ba38fde7f0d29bc5a
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/llm/e2e-distinct-2-simulated')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 5c6918972d1a7f8ad5201880b7d6d9c1191ca1f25376682f691def7868e3fd02
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 01cc37113b4d6c301e355f63decf46a21e93a023494bdfeaeed2890c97ec1f57
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/v1/subscriptions')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: 06b05a8e4dd69bdc4f333ad9509ee8cad3c5c0f5dd48edbe94c1158b60f79ed3
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: 661962837510c6dc6d1faa64e61ec3086efa9e0a2e7315c6ded616c1879e5ba8
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/v1/api-keys')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: a7740f6e77d024a437502c023fb1d8939cb3cc2b9ed7f4073af7d779e19459eb
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: f82564e076ea3e672592bab71e048537faba17a5e909884c2a0204e235905a69
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/v1/models')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: odh-ai-gateway-infra/maas-api-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: b4bfec1b33959dd0ebfc5cd6fb410688e820d4b55c7f149cb4acc4353f30a9b2
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/maas-api')
    - actions:
      - predicates:
        - request.path != "/maas-api/health" || request.method != "GET"
        scope: cd452b3491b4064e772f38d1a288406bb3889f19efd54af26f6554f07046a8c0
        service: auth-service
        sources:
        - authpolicy.kuadrant.io:openshift-ingress/maas-gateway-auth
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: "0"
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-check-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      - conditionalData:
        - data:
          - expression:
              key: tokenlimit.deny_all_by_default__6d45535f
              value: "1"
          - expression:
              key: auth.identity.userid
              value: auth.identity.userid
          - expression:
              key: ratelimit.hits_addend
              value: responseBodyJSON("/usage/total_tokens")
          predicates:
          - '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")'
        scope: llm/e2e-distinct-2-simulated-kserve-route
        service: ratelimit-report-service
        sources:
        - tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny
      name: b31b113eaf857adeea063c1c889264c6469db8010a1480fe954ee10226d78bc1
      routeRuleConditions:
        hostnames:
        - '*'
        predicates:
        - request.url_path.startsWith('/')
        - request.headers.exists(h, h.lowerAscii() == 'x-gateway-model-name' && request.headers[h]
          == 'publishers/llm/models/test/e2e-distinct-model-2')
    services:
      auth-service:
        endpoint: kuadrant-auth-service
        failureMode: deny
        timeout: 200ms
        type: auth
      ratelimit-check-service:
        endpoint: kuadrant-ratelimit-service
        failureMode: deny
        timeout: 100ms
        type: ratelimit-check
      ratelimit-report-service:
        endpoint: kuadrant-ratelimit-service
        failureMode: deny
        timeout: 100ms
        type: ratelimit-report
      ratelimit-service:
        endpoint: kuadrant-ratelimit-service
        failureMode: allow
        timeout: 100ms
        type: ratelimit
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: maas-default-gateway
  url: quay.io/kuadrant/wasm-shim:v0.12.1