apiVersion: kuadrant.io/v1alpha1
kind: TokenRateLimitPolicy
metadata:
  creationTimestamp: "2026-11-04T07:32:28Z"
  generation: 1
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/managed-by: maas-controller
    app.kubernetes.io/name: maas-api
    app.kubernetes.io/part-of: models-as-a-service
    app.opendatahub.io/modelsasservice: "true"
    maas.opendatahub.io/tenant-name: models-as-a-service
    maas.opendatahub.io/tenant-namespace: models-as-a-service
  managedFields:
  - apiVersion: kuadrant.io/v1alpha1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          f:app.kubernetes.io/component: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/part-of: {}
          f:app.opendatahub.io/modelsasservice: {}
          f:maas.opendatahub.io/tenant-name: {}
          f:maas.opendatahub.io/tenant-namespace: {}
        f:ownerReferences:
          k:{"uid":"cdf1e0d5-db23-420d-9274-d48c532457ec"}: {}
      f:spec:
        f:defaults:
          f:limits:
            f:deny-all-by-default:
              .: {}
              f:counters: {}
              f:rates: {}
              f:when: {}
        f:targetRef:
          f:group: {}
          f:kind: {}
          f:name: {}
    manager: maas-controller
    operation: Apply
    time: "2026-11-04T07:32:28Z"
  - apiVersion: kuadrant.io/v1alpha1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        .: {}
        f:conditions:
          .: {}
          k:{"type":"Accepted"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"Enforced"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
        f:observedGeneration: {}
    manager: manager
    operation: Update
    subresource: status
    time: "2026-11-04T07:34:03Z"
  name: gateway-default-deny
  namespace: openshift-ingress
  ownerReferences:
  - apiVersion: maas.opendatahub.io/v1alpha1
    blockOwnerDeletion: true
    controller: true
    kind: Config
    name: default
    uid: cdf1e0d5-db23-420d-9274-d48c532457ec
  resourceVersion: "25194"
  uid: 04d52d29-6e4d-4d53-b1c9-60ed868ba854
spec:
  defaults:
    limits:
      deny-all-by-default:
        counters:
        - expression: auth.identity.userid
        rates:
        - limit: 0
          window: 1m
        when:
        - predicate: '!request.path.startsWith("/maas-api") && !request.path.startsWith("/v1/models")
            && !request.path.startsWith("/v1/subscriptions") && !request.path.startsWith("/v1/api-keys")
            && !(request.path == "/v1/me") && !request.path.startsWith("/maas-portal")
            && !request.path.startsWith("/oauth2")'
    strategy: atomic
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: maas-default-gateway
status:
  conditions:
  - lastTransitionTime: "2026-11-04T07:32:29Z"
    message: TokenRateLimitPolicy has been accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2026-11-04T07:33:58Z"
    message: 'TokenRateLimitPolicy has encountered some issues: policy rule(s) overridden:
      deny-all-by-default by tokenratelimitpolicy.kuadrant.io:openshift-ingress/gateway-default-deny'
    reason: Unknown
    status: "False"
    type: Enforced
  observedGeneration: 1