---
apiVersion: kuadrant.io/v1
kind: AuthPolicy
metadata:
  creationTimestamp: "2026-10-30T21:07:54Z"
  generation: 1
  labels:
    app.kubernetes.io/component: llminferenceservice-policies
    app.kubernetes.io/managed-by: odh-model-controller
    app.kubernetes.io/name: llminferenceservice-auth
    app.kubernetes.io/part-of: llminferenceservice
  managedFields:
  - apiVersion: kuadrant.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          .: {}
          f:app.kubernetes.io/component: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/part-of: {}
        f:ownerReferences:
          .: {}
          k:{"uid":"a806cda1-357d-47a9-9605-6ceb70428782"}: {}
      f:spec:
        .: {}
        f:patterns:
          .: {}
          f:has-ns-and-name:
            .: {}
            f:allOf: {}
          f:is-publisher-path:
            .: {}
            f:allOf: {}
        f:rules:
          .: {}
          f:authentication:
            .: {}
            f:kubernetes-user:
              .: {}
              f:credentials: {}
              f:kubernetesTokenReview:
                .: {}
                f:audiences: {}
              f:metrics: {}
              f:overrides:
                .: {}
                f:fairness:
                  .: {}
                  f:value: {}
                f:objective:
                  .: {}
                  f:expression: {}
                f:resolvedGroups:
                  .: {}
                  f:expression: {}
                f:resolvedUser:
                  .: {}
                  f:expression: {}
              f:priority: {}
          f:authorization:
            .: {}
            f:deny-misrouted-model-header:
              .: {}
              f:metrics: {}
              f:patternMatching:
                .: {}
                f:patterns: {}
              f:priority: {}
              f:when: {}
            f:inference-access:
              .: {}
              f:kubernetesSubjectAccessReview:
                .: {}
                f:authorizationGroups:
                  .: {}
                  f:expression: {}
                f:resourceAttributes:
                  .: {}
                  f:group:
                    .: {}
                    f:value: {}
                  f:name:
                    .: {}
                    f:expression: {}
                  f:namespace:
                    .: {}
                    f:expression: {}
                  f:resource:
                    .: {}
                    f:value: {}
                  f:subresource: {}
                  f:verb:
                    .: {}
                    f:value: {}
                f:user:
                  .: {}
                  f:expression: {}
              f:metrics: {}
              f:priority: {}
              f:when: {}
            f:inference-access-delegate:
              .: {}
              f:kubernetesSubjectAccessReview:
                .: {}
                f:authorizationGroups:
                  .: {}
                  f:expression: {}
                f:resourceAttributes:
                  .: {}
                  f:group:
                    .: {}
                    f:value: {}
                  f:name:
                    .: {}
                    f:expression: {}
                  f:namespace:
                    .: {}
                    f:expression: {}
                  f:resource:
                    .: {}
                    f:value: {}
                  f:subresource: {}
                  f:verb:
                    .: {}
                    f:value: {}
                f:user:
                  .: {}
                  f:expression: {}
              f:metrics: {}
              f:priority: {}
              f:when: {}
            f:model-access-path:
              .: {}
              f:kubernetesSubjectAccessReview:
                .: {}
                f:authorizationGroups:
                  .: {}
                  f:expression: {}
                f:resourceAttributes:
                  .: {}
                  f:group:
                    .: {}
                    f:value: {}
                  f:name:
                    .: {}
                    f:expression: {}
                  f:namespace:
                    .: {}
                    f:expression: {}
                  f:resource:
                    .: {}
                    f:value: {}
                  f:subresource: {}
                  f:verb:
                    .: {}
                    f:value: {}
                f:user:
                  .: {}
                  f:expression: {}
              f:metrics: {}
              f:priority: {}
              f:when: {}
            f:model-access-path-delegate:
              .: {}
              f:kubernetesSubjectAccessReview:
                .: {}
                f:authorizationGroups:
                  .: {}
                  f:expression: {}
                f:resourceAttributes:
                  .: {}
                  f:group:
                    .: {}
                    f:value: {}
                  f:name:
                    .: {}
                    f:expression: {}
                  f:namespace:
                    .: {}
                    f:expression: {}
                  f:resource:
                    .: {}
                    f:value: {}
                  f:subresource: {}
                  f:verb:
                    .: {}
                    f:value: {}
                f:user:
                  .: {}
                  f:expression: {}
              f:metrics: {}
              f:priority: {}
              f:when: {}
          f:response:
            .: {}
            f:success:
              .: {}
              f:headers:
                .: {}
                f:x-gateway-inference-fairness-id:
                  .: {}
                  f:metrics: {}
                  f:plain:
                    .: {}
                    f:expression: {}
                  f:priority: {}
                f:x-gateway-inference-objective:
                  .: {}
                  f:metrics: {}
                  f:plain:
                    .: {}
                    f:expression: {}
                  f:priority: {}
                f:x-maas-groups:
                  .: {}
                  f:metrics: {}
                  f:plain:
                    .: {}
                    f:expression: {}
                  f:priority: {}
                  f:when: {}
                f:x-maas-user:
                  .: {}
                  f:metrics: {}
                  f:plain:
                    .: {}
                    f:expression: {}
                  f:priority: {}
                  f:when: {}
                f:x-tenant-id:
                  .: {}
                  f:metrics: {}
                  f:plain:
                    .: {}
                    f:expression: {}
                  f:priority: {}
                  f:when: {}
                f:x-user-id:
                  .: {}
                  f:metrics: {}
                  f:plain:
                    .: {}
                    f:expression: {}
                  f:priority: {}
                  f:when: {}
        f:targetRef:
          .: {}
          f:group: {}
          f:kind: {}
          f:name: {}
    manager: manager
    operation: Update
    time: "2026-10-30T21:07:54Z"
  - apiVersion: kuadrant.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        .: {}
        f:conditions:
          .: {}
          k:{"type":"Accepted"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"Enforced"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
        f:observedGeneration: {}
    manager: manager
    operation: Update
    subresource: status
    time: "2026-10-30T21:07:54Z"
  name: openshift-ai-inference-authn
  namespace: openshift-ingress
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1
    blockOwnerDeletion: true
    controller: true
    kind: Gateway
    name: openshift-ai-inference
    uid: a806cda1-357d-47a9-9605-6ceb70428782
  resourceVersion: "17264"
  uid: 3d179865-35e8-41ab-bc5b-dd225437f763
spec:
  patterns:
    has-ns-and-name:
      allOf:
      - operator: matches
        selector: context.request.http.path
        value: ^/[^/]+/[^/]+
    is-publisher-path:
      allOf:
      - operator: matches
        selector: context.request.http.path
        value: ^/publishers/[^/]+/models/
  rules:
    authentication:
      kubernetes-user:
        credentials: {}
        kubernetesTokenReview:
          audiences:
          - https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/bb469
        metrics: false
        overrides:
          fairness:
            value: https://dptp-hypershift-oidc-provider-2.s3.us-east-1.amazonaws.com/bb469
          objective:
            expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
              ? auth.identity.user.username.split('':'')[2] : ''authenticated'''
          resolvedGroups:
            expression: |-
              'x-maas-user' in request.headers ? ('x-maas-groups' in request.headers
                ? request.headers['x-maas-groups'].split(',')
                : [])
              : auth.identity.user.groups
          resolvedUser:
            expression: '''x-maas-user'' in request.headers ? request.headers[''x-maas-user'']
              : auth.identity.user.username'
        priority: 0
    authorization:
      deny-misrouted-model-header:
        metrics: false
        patternMatching:
          patterns:
          - predicate: "false"
        priority: 0
        when:
        - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
        - predicate: '!(request.path == ''/v1/files'' || request.path.startsWith(''/v1/files/'')
            || request.path == ''/v1/batches'' || request.path.startsWith(''/v1/batches/''))'
        - predicate: '''x-gateway-model-name'' in request.headers && request.headers[''x-gateway-model-name''].matches(''^publishers/[^/]+/models/.+$'')'
      inference-access:
        kubernetesSubjectAccessReview:
          authorizationGroups:
            expression: auth.identity.resolvedGroups
          resourceAttributes:
            group:
              value: serving.kserve.io
            name:
              expression: request.path.split("/")[2]
            namespace:
              expression: request.path.split("/")[1]
            resource:
              value: llminferenceservices
            subresource: {}
            verb:
              value: get
          user:
            expression: auth.identity.resolvedUser
        metrics: false
        priority: 1
        when:
        - patternRef: has-ns-and-name
        - predicate: '!request.path.startsWith(''/v1/'')'
        - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
      inference-access-delegate:
        kubernetesSubjectAccessReview:
          authorizationGroups:
            expression: auth.identity.user.groups
          resourceAttributes:
            group:
              value: serving.kserve.io
            name:
              expression: request.path.split("/")[2]
            namespace:
              expression: request.path.split("/")[1]
            resource:
              value: llminferenceservices/delegate
            subresource: {}
            verb:
              value: post-delegate
          user:
            expression: auth.identity.user.username
        metrics: false
        priority: 1
        when:
        - patternRef: has-ns-and-name
        - predicate: '!request.path.startsWith(''/v1/'')'
        - predicate: '!request.path.matches(''^/publishers/[^/]+/models/'')'
        - predicate: '''x-maas-user'' in request.headers'
      model-access-path:
        kubernetesSubjectAccessReview:
          authorizationGroups:
            expression: auth.identity.resolvedGroups
          resourceAttributes:
            group:
              value: serving.opendatahub.io
            name:
              expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
            namespace:
              expression: request.path.split('/')[2]
            resource:
              value: models
            subresource: {}
            verb:
              value: post
          user:
            expression: auth.identity.resolvedUser
        metrics: false
        priority: 1
        when:
        - patternRef: is-publisher-path
      model-access-path-delegate:
        kubernetesSubjectAccessReview:
          authorizationGroups:
            expression: auth.identity.user.groups
          resourceAttributes:
            group:
              value: serving.opendatahub.io
            name:
              expression: '''publishers/'' + request.path.split(''/'')[2] + ''/models/''
                + request.path.split(''/models/'')[1].split(''/v1/'')[0]'
            namespace:
              expression: request.path.split('/')[2]
            resource:
              value: models/delegate
            subresource: {}
            verb:
              value: post-delegate
          user:
            expression: auth.identity.user.username
        metrics: false
        priority: 1
        when:
        - patternRef: is-publisher-path
        - predicate: '''x-maas-user'' in request.headers'
    response:
      success:
        headers:
          x-gateway-inference-fairness-id:
            metrics: false
            plain:
              expression: auth.identity.fairness
            priority: 0
          x-gateway-inference-objective:
            metrics: false
            plain:
              expression: auth.identity.objective
            priority: 0
          x-maas-groups:
            metrics: false
            plain:
              expression: auth.identity.user.groups.join(',')
            priority: 0
            when:
            - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
          x-maas-user:
            metrics: false
            plain:
              expression: auth.identity.user.username
            priority: 0
            when:
            - predicate: request.path == '/v1/files' || request.path.startsWith('/v1/files/')
                || request.path == '/v1/batches' || request.path.startsWith('/v1/batches/')
          x-tenant-id:
            metrics: false
            plain:
              expression: 'auth.identity.user.username.startsWith(''system:serviceaccount:'')
                ? auth.identity.user.username.split('':'')[2] : ''default'''
            priority: 0
            when:
            - predicate: request.path.startsWith('/v1/')
          x-user-id:
            metrics: false
            plain:
              expression: auth.identity.user.username
            priority: 0
            when:
            - predicate: request.path.startsWith('/v1/')
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: openshift-ai-inference
status:
  conditions:
  - lastTransitionTime: "2026-10-30T21:07:54Z"
    message: AuthPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2026-10-30T21:07:54Z"
    message: AuthPolicy is not in the path to any existing routes
    reason: Unknown
    status: "False"
    type: Enforced
  observedGeneration: 1